Fix possible crash with animated layers in reflections
authorsimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 1 Dec 2015 02:46:09 +0000 (02:46 +0000)
committersimon.fraser@apple.com <simon.fraser@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 1 Dec 2015 02:46:09 +0000 (02:46 +0000)
https://bugs.webkit.org/show_bug.cgi?id=151689
rdar://problem/23018612

Reviewed by Darin Adler.

Reflections create additional PlatformCALayers whose owner is set to the GraphicsLayerCA.
Those PlatformCALayers need their owner pointer cleared out when the GraphicsLayerCA
is destroyed.

Tested by compositing/reflections/nested-reflection-transition.html

* platform/graphics/ca/GraphicsLayerCA.cpp:
* platform/graphics/ca/GraphicsLayerCA.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@192853 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog
Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h

index b57a426c5e776e12fa2c9c56c62f1514578d950b..e5c4534ea1eedbefaf0b31450d84080cf6f96e43 100644 (file)
@@ -1,3 +1,20 @@
+2015-11-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix possible crash with animated layers in reflections
+        https://bugs.webkit.org/show_bug.cgi?id=151689
+        rdar://problem/23018612
+
+        Reviewed by Darin Adler.
+
+        Reflections create additional PlatformCALayers whose owner is set to the GraphicsLayerCA.
+        Those PlatformCALayers need their owner pointer cleared out when the GraphicsLayerCA
+        is destroyed.
+        
+        Tested by compositing/reflections/nested-reflection-transition.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        * platform/graphics/ca/GraphicsLayerCA.h:
+
 2015-11-30  Brady Eidson  <beidson@apple.com>
 
         Modern IDB: Iterating index cursors to a specific key is busted.
 2015-11-30  Brady Eidson  <beidson@apple.com>
 
         Modern IDB: Iterating index cursors to a specific key is busted.
index ad79e9535749cc7893a5e87bf7dd7f620ba44c11..32d1bd88e69e7ffff52de1dab5f730f54039bc43 100644 (file)
@@ -3486,14 +3486,25 @@ void GraphicsLayerCA::ensureCloneLayers(CloneID cloneID, RefPtr<PlatformCALayer>
     shapeMaskLayer = findOrMakeClone(cloneID, m_shapeMaskLayer.get(), m_shapeMaskLayerClones.get(), cloneLevel);
 }
 
     shapeMaskLayer = findOrMakeClone(cloneID, m_shapeMaskLayer.get(), m_shapeMaskLayerClones.get(), cloneLevel);
 }
 
+void GraphicsLayerCA::clearClones(std::unique_ptr<LayerMap>& layerMap)
+{
+    if (!layerMap)
+        return;
+
+    for (auto& layer : layerMap->values())
+        layer->setOwner(nullptr);
+    
+    layerMap = nullptr;
+}
+
 void GraphicsLayerCA::removeCloneLayers()
 {
 void GraphicsLayerCA::removeCloneLayers()
 {
-    m_layerClones = nullptr;
-    m_structuralLayerClones = nullptr;
-    m_contentsLayerClones = nullptr;
-    m_contentsClippingLayerClones = nullptr;
-    m_contentsShapeMaskLayerClones = nullptr;
-    m_shapeMaskLayerClones = nullptr;
+    clearClones(m_layerClones);
+    clearClones(m_structuralLayerClones);
+    clearClones(m_contentsLayerClones);
+    clearClones(m_contentsClippingLayerClones);
+    clearClones(m_contentsShapeMaskLayerClones);
+    clearClones(m_shapeMaskLayerClones);
 }
 
 FloatPoint GraphicsLayerCA::positionForCloneRootLayer() const
 }
 
 FloatPoint GraphicsLayerCA::positionForCloneRootLayer() const
index 8ea46eb638fbfa9fca9239b9325d128e96c238ac..d3386559e70e8ac3c034bec0c87c77e164cd9500 100644 (file)
@@ -365,6 +365,8 @@ private:
     void ensureCloneLayers(CloneID, RefPtr<PlatformCALayer>& primaryLayer, RefPtr<PlatformCALayer>& structuralLayer,
         RefPtr<PlatformCALayer>& contentsLayer, RefPtr<PlatformCALayer>& contentsClippingLayer, RefPtr<PlatformCALayer>& contentsShapeMaskLayer, RefPtr<PlatformCALayer>& shapeMaskLayer, CloneLevel);
 
     void ensureCloneLayers(CloneID, RefPtr<PlatformCALayer>& primaryLayer, RefPtr<PlatformCALayer>& structuralLayer,
         RefPtr<PlatformCALayer>& contentsLayer, RefPtr<PlatformCALayer>& contentsClippingLayer, RefPtr<PlatformCALayer>& contentsShapeMaskLayer, RefPtr<PlatformCALayer>& shapeMaskLayer, CloneLevel);
 
+    static void clearClones(std::unique_ptr<LayerMap>&);
+
     bool hasCloneLayers() const { return !!m_layerClones; }
     void removeCloneLayers();
     FloatPoint positionForCloneRootLayer() const;
     bool hasCloneLayers() const { return !!m_layerClones; }
     void removeCloneLayers();
     FloatPoint positionForCloneRootLayer() const;